​
Event Information

  • The DeleteXssMatchSet event in AWS WAF refers to the action of deleting an XSS (Cross-Site Scripting) match set.
  • XSS match sets are used in AWS WAF to define patterns or rules that help identify and block potential XSS attacks on web applications.
  • When the DeleteXssMatchSet event occurs, it means that a specific XSS match set has been removed from the AWS WAF configuration, and any associated rules or conditions related to that match set will no longer be enforced.

​
Examples

  1. Misconfiguration: If the DeleteXssMatchSet operation is not properly configured, it can inadvertently remove important XSS (Cross-Site Scripting) match rules from the Web Application Firewall (WAF) configuration. This can lead to a decrease in security posture and potential exposure to XSS attacks.

  2. Lack of Backup: If a backup strategy is not in place before executing the DeleteXssMatchSet operation, there is a risk of permanently losing the XSS match set and its associated rules. This can result in a loss of historical data and make it difficult to recover from any security incidents or audits.

  3. Unauthorized Access: If proper access controls and permissions are not enforced, an unauthorized user may gain access to the DeleteXssMatchSet operation. This can lead to malicious deletion of XSS match sets, compromising the security of the WAF and potentially exposing web applications to XSS vulnerabilities.

​
Remediation

​
Using Console

  1. Identify the specific AWS WAF rule that needs to be remediated based on the examples provided.

    • Log in to the AWS Management Console.
    • Navigate to the AWS WAF service.
    • Select the appropriate WebACL that contains the rule to be remediated.

  2. Modify the AWS WAF rule to address the identified issue.

    • Within the selected WebACL, locate the rule that needs to be remediated.
    • Click on the rule to access its configuration settings.
    • Adjust the rule’s conditions, filters, or actions as necessary to address the issue.
    • Save the changes made to the rule.

  3. Test and monitor the remediated AWS WAF rule.

    • Deploy the updated WebACL to the appropriate AWS resources (e.g., CloudFront distribution, Application Load Balancer).
    • Monitor the traffic and logs to ensure that the remediated rule is functioning as expected.
    • Continuously monitor and analyze the logs and metrics to identify any potential issues or false positives.
    • Make further adjustments to the rule if needed based on the observed behavior.

​
Using CLI

  1. To remediate a specific rule in AWS WAF using AWS CLI, you can use the update-rule command. For example, if you want to update a rule with the ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:

    aws wafv2 update-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --action ALLOW --override-action NONE

    This command updates the specified rule in the WebACL, setting the action to ALLOW and overriding any previous actions.

  2. To remediate a rate-based rule in AWS WAF using AWS CLI, you can use the update-rate-based-rule command. For example, if you want to update a rate-based rule with the ID 12345678-1234-1234-1234-123456789012 in a WebACL named MyWebACL, you can use the following command:

    aws wafv2 update-rate-based-rule --name MyWebACL --scope REGIONAL --id 12345678-1234-1234-1234-123456789012 --rate-limit 1000

    This command updates the specified rate-based rule in the WebACL, setting the rate limit to 1000 requests per 5 minutes.

  3. To remediate a managed rule group in AWS WAF using AWS CLI, you can use the update-managed-rule-set-version command. For example, if you want to update a managed rule group with the ARN arn:aws:wafv2:us-west-2:123456789012:managed-rule-set/aws-managed/gbqj2j5k5k to the latest available version, you can use the following command:

    aws wafv2 update-managed-rule-set-version --name gbqj2j5k5k --scope REGIONAL --vendor-name aws-managed --managed-rule-set-id arn:aws:wafv2:us-west-2:123456789012:managed-rule-set/aws-managed/gbqj2j5k5k

    This command updates the specified managed rule group to the latest available version, ensuring that you have the latest rule definitions and protections in place.

​
Using Python

  1. Example 1: Blocking IP addresses with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to retrieve the IP addresses that need to be blocked.
    • Use the create_ip_set method to create an IP set in AWS WAF.
    • Use the update_ip_set method to add the IP addresses to the IP set.
    • Use the update_web_acl method to associate the IP set with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Retrieve IP addresses to block
ip_addresses = ['192.0.2.1', '203.0.113.2']

# Create IP set
response = waf_client.create_ip_set(
    Name='BlockedIPSet',
    ChangeToken='CHANGE_TOKEN'
)

# Add IP addresses to IP set
response = waf_client.update_ip_set(
    IPSetId='IP_SET_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'IPSetDescriptor': {
                'Type': 'IPV4',
                'Value': ip_address
            }
        }
        for ip_address in ip_addresses
    ]
)

# Associate IP set with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': 'IP_SET_RULE_ID',
                'Action': {
                    'Type': 'BLOCK'
                }
            }
        }
    ]
)
  1. Example 2: Rate limiting with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to define the rate limit rule.
    • Use the create_rate_based_rule method to create the rate limit rule in AWS WAF.
    • Use the update_web_acl method to associate the rate limit rule with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Define rate limit rule
rate_limit_rule = {
    'Name': 'RateLimitRule',
    'MetricName': 'RateLimitMetric',
    'RateLimit': 1000,
    'RateKey': 'IP',
    'ChangeToken': 'CHANGE_TOKEN'
}

# Create rate limit rule
response = waf_client.create_rate_based_rule(
    Name=rate_limit_rule['Name'],
    MetricName=rate_limit_rule['MetricName'],
    RateLimit=rate_limit_rule['RateLimit'],
    RateKey=rate_limit_rule['RateKey'],
    ChangeToken=rate_limit_rule['ChangeToken']
)

# Associate rate limit rule with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': 'RATE_LIMIT_RULE_ID',
                'Action': {
                    'Type': 'COUNT'
                }
            }
        }
    ]
)
  1. Example 3: Blocking SQL injection attacks with AWS WAF using Python
    • Use the AWS SDK for Python (Boto3) to interact with AWS WAF.
    • Write a Python script to define the SQL injection match condition.
    • Use the create_sql_injection_match_set method to create the SQL injection match set in AWS WAF.
    • Use the update_web_acl method to associate the SQL injection match set with the desired web ACL.
import boto3

# Create AWS WAF client
waf_client = boto3.client('waf')

# Define SQL injection match condition
sql_injection_condition = {
    'Name': 'SQLInjectionCondition',
    'ChangeToken': 'CHANGE_TOKEN',
    'SqlInjectionMatchTuples': [
        {
            'FieldToMatch': {
                'Type': 'QUERY_STRING'
            },
            'TextTransformation': 'URL_DECODE'
        }
    ]
}

# Create SQL injection match set
response = waf_client.create_sql_injection_match_set(
    Name=sql_injection_condition['Name'],
    ChangeToken=sql_injection_condition['ChangeToken'],
    SqlInjectionMatchTuples=sql_injection_condition['SqlInjectionMatchTuples']
)

# Associate SQL injection match set with web ACL
response = waf_client.update_web_acl(
    WebACLId='WEB_ACL_ID',
    ChangeToken='CHANGE_TOKEN',
    Updates=[
        {
            'Action': 'INSERT',
            'ActivatedRule': {
                'Priority': 1,
                'RuleId': 'SQL_INJECTION_RULE_ID',
                'Action': {
                    'Type': 'BLOCK'
                }
            }
        }
    ]
)